diff options
| author | Linux Build Service Account <lnxbuild@localhost> | 2017-02-26 04:44:57 -0800 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-02-26 04:44:57 -0800 |
| commit | 39668d409906cb27a5ef2e9a86ef3b73f07eb856 (patch) | |
| tree | fb623f733b87ee1cdf3f313b58bbd2cceb1535ec /drivers | |
| parent | 7a3aebc93ab37cc874019a89949e6255114da780 (diff) | |
| parent | 2bcc512e4f5112134a432355ba545311503bb1ab (diff) | |
Merge "crypto: msm: check invalid src and dst vbuf in qcedev.c"
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/crypto/msm/qcedev.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/drivers/crypto/msm/qcedev.c b/drivers/crypto/msm/qcedev.c index 5ce87a6edcc3..7459401979fe 100644 --- a/drivers/crypto/msm/qcedev.c +++ b/drivers/crypto/msm/qcedev.c @@ -1490,6 +1490,11 @@ static int qcedev_check_cipher_params(struct qcedev_cipher_op_req *req, } /* Check for sum of all dst length is equal to data_len */ for (i = 0, total = 0; i < req->entries; i++) { + if (!req->vbuf.dst[i].vaddr && req->vbuf.dst[i].len) { + pr_err("%s: NULL req dst vbuf[%d] with length %d\n", + __func__, i, req->vbuf.dst[i].len); + goto error; + } if (req->vbuf.dst[i].len >= U32_MAX - total) { pr_err("%s: Integer overflow on total req dst vbuf length\n", __func__); @@ -1504,6 +1509,11 @@ static int qcedev_check_cipher_params(struct qcedev_cipher_op_req *req, } /* Check for sum of all src length is equal to data_len */ for (i = 0, total = 0; i < req->entries; i++) { + if (!req->vbuf.src[i].vaddr && req->vbuf.src[i].len) { + pr_err("%s: NULL req src vbuf[%d] with length %d\n", + __func__, i, req->vbuf.src[i].len); + goto error; + } if (req->vbuf.src[i].len > U32_MAX - total) { pr_err("%s: Integer overflow on total req src vbuf length\n", __func__); |